Finding Your Way: A Survey of Supply Chains
summary
A lightweight map of the open source supply chain landscape that lists 12 foundations and roughly 42 projects and groups tools into five concrete categories: standards, SBOM generation, scanning, identity/attestation, and policy. Presents a specific proposal called git-bomb that uses Git-style content hashes as artifact ids, embeds those refs in build outputs, and recommends three concrete changes to compilers and build pipelines to generate tamper resistant, efficiently scannable build trees.
AI-written summary · about
chapters (7)
- 0:00Intro
- 1:30Do you have a map
- 2:00Tools
- 4:05Claims and Policies
- 7:37Revisiting the Thesis
- 9:05Git
- 13:35Embedding Git Bomb
related talks
38mSecuring the chains: Building defensive layers for software supply chains
41mSupply Chain Armoring: Tools and Techniques for Open Source Projects
30mSupply Chain Security for OpenSource Projects
35mRepurposed Purpose: Using git's DAG for Supply Chain Artifact Resolution
32mSoftware Supply Chain Security
25mLet’s Talk Software Supply Chains with TAG Security
35mAchieving End-To-End Software Supply Chain Security With in-toto
30mSecuring Open Source Supply Chains